GUIDE FOR COMPLIANCE ATTESTATION ENGAGEMENTS OF PROPRIETARY SCHOOLS EXPENDING HIGHER EDUCATION EMERGENCY RELIEF FUND GRANTS - U.S. DEPARTMENT OF ...
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
HEERF Audit Guide March 31, 2021
GUIDE FOR COMPLIANCE ATTESTATION
ENGAGEMENTS OF PROPRIETARY SCHOOLS
EXPENDING HIGHER EDUCATION EMERGENCY
RELIEF FUND GRANTS
U.S. DEPARTMENT OF EDUCATION
OFFICE OF INSPECTOR GENERAL
March 31, 2021HEERF Audit Guide March 31, 2021
Table of Contents
ABBREVIATIONS AND ACRONYMS ......................................................................................................................... 4
CHAPTER 1 – GENERAL REQUIREMENTS ................................................................................................................ 5
A. INTRODUCTION .......................................................................................................................... 5
A.1.PURPOSE AND APPLICABILITY ...................................................................................................5
A.2.BACKGROUND ..........................................................................................................................5
A.3.EFFECTIVE DATE AND IMPLEMENTATION..................................................................................7
A.4.ENGAGEMENT PERIOD AND SCOPE...........................................................................................8
A.5.REPORT DUE DATES AND SUBMISSION .....................................................................................8
B. PROFESSIONAL STANDARDS ........................................................................................................ 9
C. REQUIRED ATTESTATION COVERAGE ......................................................................................... 10
D. REFERENCES AND RESOURCES................................................................................................... 10
D.1. SOURCE OF GOVERNING REQUIREMENTS ...............................................................................10
D.2. FREQUENTLY ASKED QUESTIONS AND OTHER GUIDANCE........................................................11
E. AUDITOR QUALIFICATIONS........................................................................................................ 13
E.1. GENERAL REQUIREMENTS ......................................................................................................13
E.2. LICENSING REQUIREMENTS ....................................................................................................13
E.3. INTERNAL AUDITORS ..............................................................................................................14
F. AUDIT QUALITY AND AUDIT DOCUMENTATION ......................................................................... 14
F.1. AUTHORITY ............................................................................................................................14
F.2. DEFICIENT ATTESTATION WORK .............................................................................................14
F.3. RETENTION OF ATTESTATION DOCUMENTATION ....................................................................15
F.4. CONFIDENTIALITY OF COMMERCIAL INFORMATION IN ATTESTATION DOCUMENTATION ........ 15
G. PRIVACY RIGHTS OF STUDENTS AND PARENTS AND AUDITOR ACCESS TO RECORDS .................... 15
CHAPTER 2 – HEERF COMPLIANCE ATTESTATION ENGAGEMENTS ....................................................................... 17
A. INTRODUCTION ........................................................................................................................ 17
B. PLANNING CONSIDERATIONS FOR THE COMPLIANCE ATTESTATION ENGAGEMENTS .................. 17
B.1. ENGAGEMENT LETTER ............................................................................................................17
B.2. MANAGEMENT’S ASSERTIONS AND REPRESENTATIONS ..........................................................18
B.3. ATTESTATION RISK .................................................................................................................19
B.4. CONSIDERING INTERNAL CONTROL IN THE COMPLIANCE ATTESTATION ENGAGEMENT........... 19
B.5. CONSIDERING AND REPORTING FRAUD IN THE COMPLIANCE ATTESTATION ENGAGEMENT .... 20
B.6. MATERIALITY FOR PURPOSES OF PROVIDING OPINION ...........................................................21
B.7. FOLLOW-UP ON RESOLUTION OF PRIOR FINDINGS..................................................................21
B.8. SAMPLING METHODOLOGY ....................................................................................................22
B.9. REPORTING NONCOMPLIANCE ...............................................................................................22
B.10. REPORTING MATERIAL NONCOMPLIANCE (SAMPLE RESULTS THAT REQUIRE PROJECTIONS) ... 22
C. COMPLIANCE REQUIREMENTS AND ATTESTATION PROCEDURES ............................................... 23
C.1. ACTIVITIES ALLOWED OR UNALLOWED ...................................................................................23
C.2. ALLOWABLE COSTS AND COST PRINCIPLES..............................................................................27
C.3. EARMARKING .........................................................................................................................31
C.4. PERIOD OF PERFORMANCE .....................................................................................................33
C.5. PROCUREMENT SUSPENSION AND DEBARMENT .....................................................................35
C.6. REPORTING ............................................................................................................................38
D. COMPLIANCE ATTESTATION ENGAGEMENT REPORT CONTENTS ................................................ 43
D.1. INFORMATION SHEET .............................................................................................................43
D.2. REPORT ON MANAGEMENT’S ASSERTIONS ON COMPLIANCE ..................................................43
D.3. SCHEDULE OF FINDINGS AND QUESTIONED COSTS..................................................................43
D.4. SUMMARY SCHEDULE OF PRIOR FINDINGS .............................................................................45
Page 2HEERF Audit Guide March 31, 2021
D.5. CORRECTIVE ACTION PLAN .....................................................................................................46
D.6. ILLUSTRATIVE COMPLIANCE ATTESTATION ENGAGEMENT REPORTS, SCHEDULES, AND FORMS47
D.6-1 Information Sheet..........................................................................................................................48
D.6-2a Report on Management’s Assertions on Compliance for the Higher Education Emergency Relief Fund Grant
Program Required by the Guide for Compliance Attestation Engagements of Proprietary Schools Expending
Higher Education Emergency Relief Fund Grants (Unmodified Opinion, No Reportable Findings).....49
D.6-2b Report on Management’s Assertions on Compliance for the Higher Education Emergency Relief Fund Grant
Program Required by the Guide for Compliance Attestation Engagements of Proprietary Schools Expending
Higher Education Emergency Relief Fund Grants (Unmodified Opinion, Reportable Findings)...........51
D.6-2c Report on Compliance for the Higher Education Emergency Relief Fund Grant Program Required by the Guide
for Compliance Attestation Engagements of Proprietary Schools Expending Higher Education Emergency Relief
Fund Grants (Qualified Opinion, Reportable Findings).....................................................................53
D.6-3 Schedule of Findings and Questioned Costs ....................................................................................55
D.6-4 Summary Schedule of Prior Findings ..............................................................................................56
D.6-5 Corrective Action Plan ...................................................................................................................56
Page 3HEERF Audit Guide March 31, 2021
ABBREVIATIONS AND ACRONYMS
Acronym Definition
AICPA American Institute of Certified Public Accountants
ALN Assistance Listing Number
ARP American Rescue Plan
AT-C AICPA Attestation Standards (Clarified)
CARES Act Coronavirus Aid, Relief, and Economic Security Act
CFDA Catalog of Federal Domestic Assistance
C.F.R. Code of Federal Regulations
CRRSAA Coronavirus Response and Relief Supplemental Appropriations Act
ED U.S. Department of Education
FAQ Frequently Asked Questions
FAR Federal Acquisition Regulation
GAGAS Generally Accepted Government Auditing Standards
Guide Guide for Compliance Attestation Engagements of Proprietary Schools
Expending Higher Education Emergency Relief Fund Grants
HEA Higher Education Act of 1965, as amended
HEERF Higher Education Emergency Relief Fund
HCM Heightened Cash Monitoring
OIG Office of Inspector General
OIG/IS Office of Inspector General, Investigation Services
OMB Office of Management and Budget
PII Personally Identifiable Information
Uniform Guidance Title 2 of the C.F.R, Chapter II, Part 200 Uniform Administrative
Requirements, Cost Principles, and Audit Requirements for Federal
Awards
Page 4HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
CHAPTER 1 – GENERAL REQUIREMENTS
A. INTRODUCTION
A.1. PURPOSE AND APPLICABILITY
This Guide for Compliance Attestation Engagements of Proprietary Schools Expending Higher
Education Emergency Relief Fund Grants (Guide) developed by the U.S. Department of
Education (ED) Office of Inspector General (OIG) applies to and provides requirements and
guidance for compliance attestation engagements of proprietary schools, as defined in Title 34 of
the Code of Federal Regulations (C.F.R.) § 600.5, receiving Higher Education Emergency Relief
Fund (HEERF) grants through the Coronavirus Aid, Relief, and Economic Security Act
(CARES Act) (HEERF I), the Coronavirus Response and Relief Supplemental Appropriations
Act, 2021 (CRRSAA) (HEERF II), or the American Rescue Plan (ARP) (HEERF III)
(collectively, HEERF grant programs).
This Guide is to be used by auditors of all proprietary schools receiving any HEERF grants,
except those proprietary schools that expended less than $500,000 in total HEERF grant funds,
whether received under the CARES Act, the CRRSAA, the ARP, or any future acts during the
fiscal year and are not otherwise on Heightened Cash Monitoring (HCM) 1 or 2 status during the
fiscal year in which it expended any HEERF grant funds and are therefore exempt from HEERF
compliance audits, as described in the Background section below.
A.2. BACKGROUND
The purpose of the HEERF grant programs generally is to use HEERF grant funds to “prevent,
prepare for, and respond to coronavirus” through grants to eligible schools. Each grant award
type, denoted by separate Assistance Listing Numbers (ALNs) (formerly Catalog of Federal
Domestic Assistance (ALN)) alpha, has specific compliance requirements, as described more
below.
CARES Act (HEERF I): The HEERF I grant programs had several different methods for the
distribution of the approximately $14 billion in funds to eligible schools based on a student
enrollment formula and school status. Ninety percent of the $14 billion ($12.56 billion) was
distributed under Section 18004(a)(1) of the CARES Act to schools using a formula based on
student enrollment, of which at least 50 percent must be reserved to provide students with
emergency financial aid grants to help cover expenses related to the disruption of campus
operations due to coronavirus (the “Student Aid Portion”; ALN 84.425E) and the remainder of
which may be used to cover any costs associated with significant changes to the delivery of
instruction due to the coronavirus (the “Institutional Portion”; ALN 84.425F). The remainder of
the $14 billion was distributed under the funding streams in Sections 18004(a)(2) and
18004(a)(3), depending on the school’s eligibility under other Higher Education Act of 1965, as
amended (HEA) grant programs, the composition of their student body, and whether the total
amount of HEERF funding received by the school would otherwise have been less than
$500,000.
Page 5HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
In order to notify each school of the eligibility for funding, and the allocation amount they could
apply for under each ALN, ED published lists of eligible schools and their allocation amounts
based on the formulas provided in each HEERF I program. Proprietary schools subject to audit
in accordance with this Guide were eligible to receive awards only under the Student Aid Portion
(ALN 84.425E) and the Institutional Portion (ALN 84.425F) of Section 18004(a)(1) of the
CARES Act. Per Section 314(d)(4) of the CRRSAA, any unobligated CARES Act Section
18004(a)(1) funds as of December 27, 2020, were repurposed for and have been included in the
total funds allocated to eligible institutions under CRRSAA Section 314(a)(1).
CRRSAA (HEERF II): The CRRSAA appropriated approximately $82 billion for the Education
Stabilization Fund, of which HEERF is a part. The CRRSAA provides an additional
$22.7 billion for institutions through the HEERF and was made available to schools to serve
students and ensure learning continues during the COVID-19 pandemic. ED awarded
$20.5 billion to public and non-profit schools, in the form of supplements and as new awards, to
be used for financial aid grants to students (Student Aid Portion for Public and Nonprofit
Institutions (a)(1), ALN 84.425E) as well as for student support activities and a variety of
institutional costs (Institutional Portion for Public and Nonprofit Institutions (a)(1),
ALN 84.425F). Proprietary schools were awarded $681 million to be used exclusively to provide
financial aid grants to students under a new program, Proprietary Institutions Grant Funds for
Students (a)(4), ALN 84.425Q.
Allocations to schools under Section 314(a)(1) of CRRSAA (the analogous provision to
Section 18004(a)(1) of the CARES Act) were based on a formula that includes the relative shares
of Federal Pell Grant recipients, the relative shares of non-Pell Grant recipients, and the relative
shares of Federal Pell and non-Pell Grant recipients exclusively enrolled in distance education
prior to the coronavirus emergency. Allocations to proprietary schools under Section 314(a)(4)
of CRRSAA were based on the factors described in Section 314(a)(1).
ARP (HEERF III): The ARP provided almost $40 billion to be used for making additional
HEERF allocations to schools under generally the same terms and conditions of Section 314
of CRRSAA. HEERF funds awarded to proprietary schools under ARP are to be used
exclusively to provide financial aid grants to students (Proprietary Institutions Grant Funds for
Students (a)(4), ALN 84.425Q). Allocations to proprietary schools under ARP will be based on
similar factors as CRRSAA but will represent a smaller percentage of the 314(a)(1) allocation.
Section 2003(5) of the ARP also requires grantees to use a portion of funds to implement
practices to monitor and suppress coronavirus and to conduct outreach to financial aid applicants
about the opportunity to receive a financial aid adjustment. These requirements do not apply to
proprietary schools because proprietary schools must award all their ALN 84.425Q HEERF
funds as financial aid grants to students.
Audit Requirement: The requirement for a HEERF compliance audit was communicated to
schools through a letter sent to all schools, dated March 8, 2021. As a condition of the HEERF
award, a proprietary school must have a compliance audit conducted of its administration of the
HEERF grant for any fiscal year during which the eligible school (see Section A.4 of this
Chapter) expends $500,000 or more in total HEERF grant funds, whether under section
Page 6HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
18004(a)(1) of the CARES Act, section 314(a)(4) of the CRRSAA, section 2003 of the ARP, or
any future acts passed by Congress that include HEERF or is on Federal Student Aid’s HCM 1
or HCM 2 list in a fiscal year in which it expended any HEERF grant funds
(https://studentaid.gov/data-center/school/hcm). This audit requirement applies to both the
Student Aid Portion and Institutional Portion of funding provided to proprietary institutions
under ALN 84.425E and 84.425F as well as the Proprietary Institutions Grant Funds for
Students program under ALN 84.425Q. The HEERF compliance audit must be conducted in
accordance with Generally Accepted Government Auditing Standards (GAGAS), issued by the
Comptroller General of the United States, and this Guide. To satisfy the HEERF compliance
audit requirement, this Guide requires an examination-level attestation engagement.
A proprietary school that expends less than $500,000 in HEERF grant funds during its fiscal year
and is not otherwise on HCM 1 or HCM 2 status during a fiscal year in which it expends any
HEERF grant funds is exempt from this HEERF compliance audit requirement for that fiscal
year, but the grant records must be available for review or audit by appropriate officials of ED.
A.3. EFFECTIVE DATE AND IMPLEMENTATION
This Guide is effective upon issuance for the first fiscal year during which a school expends
HEERF award funds.
This Guide is organized into two Chapters:
• Chapter 1 – General Requirements. Provides the purpose, background, implementation,
and effective date of this Guide.
• Chapter 2 – HEERF Compliance Attestation Engagements. Provides specific
information and required procedures for conducting compliance attestation engagements
of schools expending HEERF grant funds.
Throughout this Guide we use the terms “we,” “you,” and “your.” “We” means ED-OIG.
“You” and “your” refer to the auditor(s) who are conducting the compliance attestation
engagement. Under GAGAS, an auditor is an individual assigned to planning, directing,
performing engagement procedures or reporting on GAGAS engagements (including work on
audits, attestation engagements, and reviews of financial statements) regardless of job title.
Therefore, individuals who may have the title auditor, information technology auditor, analyst,
practitioner, evaluator, inspector, or other similar titles are considered auditors under GAGAS
and this Guide. Similarly, we will use the terms HEERF compliance audit, audit period, audit
findings, or audit package throughout this Guide to refer to the examination-level compliance
attestation engagement performed in accordance with this Guide and the resulting findings and
report package.
You are responsible for ensuring that you are using the most current version of this Guide, and/or
considering all applicable amendments to it. You should periodically review the ED-OIG
website for updated information regarding this Guide at: OIG Non-Federal Audit website.
Page 7HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
If you have questions about the compliance requirements discussed in this Guide, email
HEERF@ed.gov. If you have questions about any other aspects of this Guide, or if you have any
comments on or suggestions about improving this Guide, please send them to
oignon-federalaudit@ed.gov.
A.4. ENGAGEMENT PERIOD AND SCOPE
For the compliance attestation engagements covered in this Guide, the period covered will be the
school’s fiscal year.
The compliance attestation engagement must be conducted at the eligible school level, for
example, at the school identified in the signed Program Participation Agreement. You can also
identify the eligible school by the first six digits of the assigned eight-digit OPE ID number. The
scope of the compliance attestation engagement must include funds provided through the eligible
school to students attending additional locations of that school.
Although not required, we recommend that the school engage the same auditor to perform this
HEERF compliance audit in conjunction with the school’s annual financial statement audit and
Title IV compliance audit conducted in accordance with the Guide for Audits of Proprietary
Schools and For Compliance Attestation Engagements of Third-Party Servicers Administering Title
IV Programs. To the extent practicable, the annual Title IV compliance audit may be used to
cover certain areas of the HEERF compliance audit if separately auditing those areas would be
duplicative. For example, you may be able to use portions of your understanding of internal
control over the Title IV programs if Title IV and HEERF are administered by the same
organizational component within the school and there is overlap between the controls over
compliance requirements in the Title IV compliance audit and this examination engagement.
A.5. REPORT DUE DATES AND SUBMISSION
Report packages for the compliance attestation engagements conducted in accordance with this
Guide, which will be referred to as the HEERF audit package, must be submitted within the later
of 120 days after issuance of this Guide, or the submission deadline for the school’s Title IV
audit, as established by 34 C.F.R. § 668.23(a)(4), including any extensions granted by ED for
those audits.
The HEERF audit package will be submitted via Federal Student Aid’s eZ-Audit System, the
same system that is already used to submit the annual Title IV audit. The eZ-Audit system is a
web-based paperless single point of submission for audited financial statements and compliance
audits or attestation engagements. The school enters summary audit information into a web form,
attaches a copy of the audit package in Adobe Acrobat (.pdf) format, and submits all information
to ED via the eZ-Audit system.
Proprietary schools must include the HEERF audit package as part of their annual Title IV audit
submission in eZ-Audit if the annual Title IV audit and HEERF audit have the same due date.
Schools should follow the eZ-Audit Step-by-Step Guide to complete the annual Title IV audit
Page 8HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
submission, but schools should upload their HEERF compliance attestation engagement package
as an “Other” file type on the Upload Attachments page.
Due to the timing of the audit requirement and the issuance of this Guide, proprietary school’s
first HEERF audit likely will not have the same due date as their Title IV audit of the same fiscal
year. Therefore, schools should submit their first HEERF audit package as a Stub Audit
Submission. In the Stub Audit Submission Compliance Audit Information screen of eZ-Audit,
“HEERF audit package” should be entered as the reason for stub audit in Question 1. For
Question 3, answer “Yes” if the HEERF audit contained any findings related to the HEERF
program. The HEERF audit package will not contain the same reports and schedules listed on
the Completeness Checklist page.
Instructions for eZ-Audit registration and eZ-Audit are available at the eZ-Audit website.
Questions about eZ-Audit can be e-mailed to fsaezaudit@ed.gov.
Schools may contract with you to perform eZ-Audit data entry and submit the compliance
attestation engagement to the eZ-Audit system. However, it is the responsibility of the school to
ensure that the reports are submitted within the specified deadlines. Failure to meet due dates
may result in administrative proceedings leading to sanctions against the school.
B. PROFESSIONAL STANDARDS
The audit condition in the HEERF audit letter dated March 8, 2021 requires that the compliance
audit be conducted in accordance with GAGAS, issued by the Comptroller General of the United
States. All references to GAGAS in this Guide are to the July 2018 revision (GAO-18-568G),
available from the Government Accountability Office Yellow Book website. HEERF
compliance attestation engagements must be conducted in accordance with the standards
applicable to examination engagements contained in GAGAS and, as applicable, the American
Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation
Engagements, which are codified in the AT-C section of the AICPA’s Professional Standards.
AT-C section 315, Compliance Attestation, is particularly relevant to compliance attestation
engagements of schools.
Please note that in addition to incorporating the AICPA’s attestation standards, GAGAS contains
additional requirements, including requirements pertaining to continuing professional education,
independence, peer review, and conducting and reporting on attestation engagements. This
Guide specifically discusses some of the requirements contained in GAGAS and the AICPA
standards to emphasize those matters or provide guidance on how they apply to these
engagements. However, you are responsible for complying with all of the applicable
requirements and being familiar with the related guidance contained in the professional standards
that apply to the compliance attestation engagement. In addition, this Guide contains specific
requirements and procedures that may go beyond what would otherwise be required in a GAGAS
compliance attestation engagement. You are required to comply with these requirements in
addition to the professional standards described above.
Page 9HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
All professional standard citations are current as of the issue date of this Guide. As revisions to
applicable professional standards become effective, you should modify your methodology for
conducting and reporting on compliance attestation engagements, as needed to comply with the
revised standards.
C. REQUIRED ATTESTATION COVERAGE
GAGAS and the AICPA standards define two levels of professional requirements and use
specific terminology to identify these requirements. This Guide uses these levels of
requirements and terminology consistent with the standards. The two levels of requirements are
unconditional requirements and presumptively mandatory requirements. Auditors must comply
with unconditional requirements in all cases where the requirement is relevant. Unconditional
requirements are identified using the term “must.” Auditors must also comply with
presumptively mandatory requirements in all cases where the requirement is relevant, except in
rare circumstances where performing the required procedure would be ineffective in achieving
the intent of the requirement. In those cases, the auditor should perform alternative procedures
to achieve the intent of the requirement and must document the auditor’s justification for the
departure from the required procedure (i.e., why performing the required procedure would not
achieve the intent of the requirement, and how performing the alternative procedure(s) were
sufficient to achieve that intent). Presumptively mandatory requirements are identified using the
term “should.”
Unless otherwise noted, the attestation procedures in Chapter 2 are presumptively mandatory
requirements. The auditor is expected to perform all of the procedures that are relevant to the
particular engagement except in rare circumstances where the procedure would be ineffective in
achieving the intent of the requirement. In those rare cases, the auditor must (1) document the
auditor’s justification for departing from the procedure, (2) perform alternative procedures to
achieve the intent of the requirement, and document how the alternative procedure achieved the
intent of the requirement. In addition, the procedures in this Guide may not cover all possible
circumstances that you may encounter at a particular school. It may be necessary for you to
perform additional procedures during the compliance attestation engagement due to specific
circumstances encountered at the school or changes in compliance requirements. In such
circumstances, you should supplement or revise these procedures as necessary, using
professional judgment, to achieve the attestation objectives and provide proper coverage.
D. REFERENCES AND RESOURCES
D.1. SOURCE OF GOVERNING REQUIREMENTS
The main source of governing requirements are (1) the CARES Act, Pub. L. No. 116-136
(March 27, 2020); (2) the CRRSAA, Pub. L. No. 116-260 (December 27, 2020); and (3) the
ARP, Pub. L. No. 117-2 (March 11, 2021).
In addition to the required SF-424 form, a completed Certification and Agreement was the
application used to award HEERF I funds under each ALN alpha. Although the Certifications
Page 10HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
and Agreements are no longer active applications, they helped form the basis of the governing
requirements for this program.
1. (a)(1) Student Aid Portion Certification and Agreement (ALN 84.425E)
2. (a)(1) Institutional Portion Certification and Agreement (ALN 84.425F)
Institutions seeking allocations of HEERF II under section 314(a)(4) of the CRRSAA had to
apply for funding through the Proprietary Institution Grant Funds for Students Certification and
Agreement, ALN 84.425Q, (a)(4) Program. This “Red C&A” also forms the basis of the
governing requirements for the HEERF II and HEERF III program.
A notice of interpretation regarding period of allowable expenses for funds administered under
the HEERF grant programs was issued on March 22, 2021 (86 FR 15208).
Furthermore, the regulations in the Education Department General Administrative Regulations
34 C.F.R. parts 75, 77, 81, 82, 84, 86, 97, 98, and 99; the Office of Management and Budget
(OMB) Guidelines to Agencies on Governmentwide Debarment and Suspension (non-
procurement) in 2 C.F.R. part 180, as adopted and amended as regulations of ED in 2 C.F.R.
part 3485; and Subparts A through E of Title 2 of the C.F.R, Chapter II, Part 200 Uniform
Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards
(Uniform Guidance), as adopted and amended as regulations of ED in 2 C.F.R. part 3474 also
apply.
All regulatory citations in this Guide are current as of the issue date of this Guide, unless
otherwise noted. 1 You will need to look at earlier or subsequent volumes to ensure you use the
regulations that were in effect during the period under review. Current regulations are available
at the Electronic Code of Federal Regulations website at: Current C.F.R.-ED and regulations for
multiple years are at C.F.R. by Year.
D.2. FREQUENTLY ASKED QUESTIONS AND OTHER GUIDANCE
A number of documents posted on ED’s CARES Act HEERF I website or CRRSAA HEERF II
website contain information pertinent to the compliance requirements described in this Guide. As
of publication of this Guide, ED had not developed a HEERF IIII website or issued HEERF III
guidance. ED strongly encourages auditors to regularly check the HEERF I and HEERF II
websites, as well as any additional websites containing HEERF III guidance, for updated
Frequently Asked Questions (FAQs) and other pertinent guidance and reporting information. The
information below is current as of the date of publication of this Guide.
1 Uniform Guidance was revised effective November 12, 2020 for most amendments. However, since the revisions
are not applicable to Federal financial assistance awards issued prior to the effective date (including awards under
the CARES Act issued prior to that date), this Guide does not reflect the Uniform Guidance revisions. If your
auditee received a HEERF award on or after November 12, 2020, you would need to use the revised Uniform
Guidance regulations.
Page 11HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
CARES Act HEERF I:
• CARES Act HEERF Rollup FAQs (Compilation of all five previously-released HEERF
FAQ documents in one document) (October 14, 2020) (these are the following five FAQ
documents listed below)
• HEERF Reporting Requirements & Lost Revenue Discussion Webinar (October 14,
2020)
o Webinar Recording
o Slides used in the Presentation
• HEERF Technical Assistance Webinar (June 23, 2020)
o Webinar Recording
• HEERF Student Portion Public Reporting Requirement (August 31, 2020; Federal
Register Notice revising the original May 6, 2020 Electronic Announcement)
• HEERF Institution Portion, (a)(2), and (a)(3) Funds Public Reporting Forms (October 13,
2020)
o Microsoft Word Version | PDF Version
o Email to Grantees Regarding HEERF Reporting Requirements (September 23,
2020)
Post-October 14, 2020 webinar email to grantees with several technical
FAQs regarding posting the quarterly reporting form (October 20, 2020)
• HEERF Annual Reporting resources
o User Guide, Webinar, and Other Resources
o Annual Reporting Form Data Elements (December 21, 2020)
o Email to grantees successfully submitting portal access information (December
21, 2020)
o Letter from Acting Assistant Secretary Extending Reporting Deadline (January
28, 2021)
CRRSAA HEERF II:
• (a)(4) Frequently Asked Questions (January 14, 2021 and updated March 19, 2021)
• Letter from the Acting Assistant Secretary (January 14, 2021)
• HEERF I and HEERF II Comparison Fact Sheet (January 14, 2021 and updated March
19, 2021)
• HEERF Lost Revenue Frequently Asked Questions (March 19, 2021)
• HEERF Period of Allowable Expenses Grant Records Notice (March 19, 2021)
Page 12HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
The COVID-19 pandemic has led to many federal agencies having to issue implementing
guidance (e.g., frequently asked questions, memos, etc.) outside of the normal regulatory process
for new and existing programs receiving COVID-19 funding. Such guidance is issued to
communicate an agency’s understanding of how the relevant statutes, regulations, or the terms
and conditions of the Federal awards to the extent they exist, apply to a particular circumstance,
but it does not create new compliance requirements. Due to the evolving nature of the pandemic
environment, it has been common for Federal agencies to update, change, or delete their specific
guidance over time.
This Guide often refers auditors to agency guidance documents to obtain a better understanding
of statutory and regulatory compliance requirements subject to audit. When evaluating a
school’s compliance, auditors must consider provisions of Federal statutes, regulations, and the
terms and conditions of Federal awards. However, auditors may also consider guidance
documents in effect during the period to understand the program requirements. An auditor may
conclude that the school is in compliance with a type of compliance requirement based on
consideration of applicable implementing guidance in effect at the time of the activity or
transaction.
When citing criteria for audit findings, this Guide requires that your finding include the criteria
or specific requirement upon which the finding is based, including the Federal statues,
regulations, or the terms and conditions of the Federal awards (Chapter 2, Section D.3).
Therefore, auditors should refer to a statute, regulation, or term and condition as criteria for the
audit finding.
E. AUDITOR QUALIFICATIONS
E.1. GENERAL REQUIREMENTS
To conduct engagements in accordance with GAGAS, auditors and audit firms should meet the
standards discussed in GAGAS Chapters 3 through 5 related to (1) Ethics, Independence, and
Professional Judgment; (2) Competence and Continuing Professional Education, and (3) Quality
Assurance and Peer Review.
E.2. LICENSING REQUIREMENTS
To conduct the compliance attestation engagements covered by this Guide, auditors should be
licensed certified public accountants, persons working for licensed certified public accounting
firms, or licensed accountants in states that have multiclass licensing systems that recognize
licensed accountants other than certified public accountants (GAGAS 7.07).
You and your audit firm should also comply with applicable provisions of the public
accountancy laws and rules of the jurisdiction in which you are licensed and the public
accountancy laws and rules of the jurisdiction where the engagement is being conducted. If the
school is located in a jurisdiction outside your home jurisdiction, this Guide requires that you
document, in the attestation work papers (or a central file at the firm available upon request), that
Page 13HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
you complied with the applicable jurisdiction’s public accountancy licensing requirements in
effect at the time the attestation engagement was conducted.
Practice mobility for certified public accountants is the general ability of a licensee in good
standing from a substantially equivalent state to gain practice privilege outside of their home
state without getting an additional license in the state where they will be serving a client or an
employer. The AICPA and National Association of State Boards of Accountancy have
developed an online tool to help certified public accountants and accounting firms understand the
implications of mobility and assist in determining whether mobility applies to their situation.
The tool is located at CPAMobility.org.
E.3. INTERNAL AUDITORS
A school’s internal auditors are not independent of the school when attesting within it.
Therefore, internal auditors cannot conduct engagements prescribed by this Guide. However,
you may consider the work of internal auditors in conducting the compliance attestation
engagement by following AT-C § 205 A.39-.44 Using the Work of Internal Auditors.
F. AUDIT QUALITY AND AUDIT DOCUMENTATION
F.1. AUTHORITY
The Inspector General Act of 1978 requires Inspectors General to take appropriate steps to
ensure that any work performed by Non-Federal auditors complies with applicable standards.
Accordingly, we select audits/attestation engagements and conduct (or engage contractors to
conduct on our behalf) Quality Control Reviews of work performed by Non-Federal auditors,
including attestation engagements conducted in accordance with this Guide. Also, ED officials
monitor and resolve attestation engagement findings of participating schools. Such monitoring
and attestation engagement resolution may require access to and copies of attestation
documentation.
All attestation supporting documentation must be made available, and photo or electronic copies
of attestation documentation provided upon request to ED, ED-OIG, or their contractors or
representatives.
F.2. DEFICIENT ATTESTATION WORK
If quality deficiencies in the attestation report or the associated documentation of work are found
during a Quality Control Review, we may instruct you to take corrective action. If we determine
that the report and/or documentation of work are unacceptable (i.e., contains quality deficiencies
that may affect the reliability of the attestation report(s) and/or may require the auditor to
conduct additional attestation work to support the reports in the reporting package under review),
we may refer the matter to the appropriate licensing bodies in the state in which you are located
and/or to professional associations of which you are a member. Action may also be initiated to
Page 14HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
debar you from further participation in audits and attestation engagements of Federal programs.
We may also recommend that ED reject the attestation reports.
F.3. RETENTION OF ATTESTATION DOCUMENTATION
You should retain attestation documentation and reports for a minimum of five years (AT-C
§ 105 A.36) after the date of issuance of the compliance attestation engagement report(s) to the
school, unless a pertinent law or regulation provides for a longer retention period, or you are
notified in writing by ED or OIG to extend the retention period. You should keep all records
questioned by an audit or attestation engagement, investigation, or other review until the
resolution of the questioned items.
F.4. CONFIDENTIALITY OF COMMERCIAL INFORMATION IN
ATTESTATION DOCUMENTATION
Confidential commercial information, as defined by the Freedom of Information Act, means
trade secrets and commercial or financial information that is privileged or confidential. If your
attestation documentation contains confidential commercial information, you should take
appropriate steps to identify that information in the attestation documentation to protect its
confidentiality.
If we request you submit attestation documentation (electronically or photocopies) and we
subsequently receive a request under the Freedom of Information Act for information that you
have designated as confidential commercial information, we will make an independent
determination under the Freedom of Information Act of whether that information meets the
criteria for exemption from release. To the extent permitted by law, we will make a good faith
effort to notify you and provide you with an opportunity to object if we disagree with your
identification of the information as confidential commercial information. We will also make a
good faith effort to provide the auditee an opportunity to object if the confidential commercial
information concerns the auditee.
If you have not designated the information as confidential commercial information in the
attestation documentation, we may assume that it does not include such information and may
release it in response to a Freedom of Information Act request.
G. PRIVACY RIGHTS OF STUDENTS AND PARENTS AND AUDITOR
ACCESS TO RECORDS
Personally Identifiable Information (PII) is defined by 34 C.F.R. § 99.3 as any information about
an individual maintained by an agency or its servicer that can be used to distinguish or trace an
individual’s identity, such as his or her name, social security number, date and place of birth,
mother's maiden name or any other personal information which can be linked to an individual
and is prohibited in the compliance attestation engagement report.
The Family Educational Rights and Privacy Act requires educational agencies and institutions
administering funds to protect the privacy of student and parent records. According to 34 C.F.R.
Page 15HEERF Audit Guide March 31, 2021
CHAPTER 1 – GENERAL REQUIREMENTS
§ 99.31(a)(4), the school can make PII available to you without a student’s or parent’s consent if
that disclosure is for the purpose of determining eligibility for the aid received, the amount of aid
received, the conditions for the aid received, or enforcing the terms and conditions of the aid.
Compliance attestation engagements conducted under this Guide are required by ED for such
purposes. If the school refuses to provide PII to you necessary to conduct any part of the
engagement, immediately contact the ED-OIG Non-Federal Audit Team at
oignon-federalaudit@ed.gov for advice on how to proceed. Please note that you are also
required to maintain the confidentiality of PII and may only disclose it for authorized purposes.
Page 16HEERF Audit Guide March 31, 2021
CHAPTER 2 – HEERF COMPLIANCE ATTESTATION ENGAGEMENTS
CHAPTER 2 – HEERF COMPLIANCE ATTESTATION
ENGAGEMENTS
A. INTRODUCTION
As a condition of the HEERF award, a proprietary school must have a compliance audit
conducted of its administration of the HEERF grant for any fiscal year during which the school
expends $500,000 or more in total HEERF grant funds or is on Federal Student Aid’s HCM 1 or
HCM 2 list in a fiscal year in which it expends any HEERF grant funds (Chapter 1, Section A.2).
To satisfy the compliance audit requirement, this Guide requires an examination-level attestation
engagement relating to the school management’s assertions about certain compliance aspects
related to the HEERF program. The compliance attestation engagement must be conducted in
accordance with the standards applicable to examination engagements contained in GAGAS and
AICPA’s clarified attestation standards.
This chapter discusses planning considerations and identifies the compliance requirements,
attestation objectives, and attestation procedures for compliance requirements pertaining to the
HEERF program that must be tested in the compliance attestation engagement when applicable
to the audited entity. For each compliance requirement, the auditor must test all HEERF Funds,
whether under section 18004(a)(1) of the CARES Act, section 314(a)(4) of the CRRSAA, or
section 2003 of the ARP, as applicable.
B. PLANNING CONSIDERATIONS FOR THE COMPLIANCE
ATTESTATION ENGAGEMENTS
The objective of the compliance attestation engagement is to assess a school’s compliance with
criteria established by the CARES Act, CRRSAA, and/or ARP and the terms and conditions of
the awards and to obtain sufficient evidence on compliance to form an opinion. The following
are common to all compliance attestation engagements conducted in accordance with this Guide.
B.1. ENGAGEMENT LETTER
An engagement letter between you and the school should be prepared and should include the
following:
• A statement that the engagement is to be conducted in accordance with GAGAS, the
applicable AICPA attestation standards, and this Guide.
• A description of the scope of the engagement and the related reporting that will meet the
requirements of this Guide.
• A statement that the auditor(s), the audit firm, its partners, assigned audit staff or contractors
capable of substantially influencing the development or outcome of the engagement are not
currently debarred from participating in any procurement and non-procurement transactions
of any Federal executive branch agency.
Page 17HEERF Audit Guide March 31, 2021
CHAPTER 2 – HEERF COMPLIANCE ATTESTATION ENGAGEMENTS
• Disclose the names of any contractors, or staff of the auditor or the firm, that will be working
on the engagement that are debarred from participating in any procurement and non-
procurement transactions of any Federal executive branch agency.
• A statement that both parties understand that ED will use the auditor's report to help carry out
its oversight responsibilities of the HEERF grant.
• A statement that the school provides the auditor all required representations and assertions, as
well as the required corrective action plan if findings are disclosed during the compliance
attestation engagement.
• A statement that the school has informed the auditor of early implementation on any
regulatory changes.
• A statement that the school understands that the auditor is required to immediately report to
the ED’s OIG, Investigation Services any indications of fraud related to HEERF grants or
any possible fraud identified by management that was not appropriately reported.
• A provision that the auditor should provide upon request from ED, the ED-OIG, or their
representatives, access to attestation documentation, including access to attestation
information stored in electronic format, and including the ability to retain copies of that
information in paper or electronic form.
• A provision that the auditor should retain attestation documentation and reports for a
minimum of five years after the date of issuance of the auditor’s report(s) to the entity, unless
a pertinent law or regulation provides for a longer retention period, or the auditor is notified
in writing by ED or us to extend the retention period.
• A provision that the auditor provides a copy of his/her firm’s most recent external peer
review report to the school procuring the auditor’s services when requested and will provide
any subsequent external peer review reports during the life of the contract, when requested.
• A provision that the auditor will provide a copy of his/her individual CPA license and/or firm
license to the school procuring the auditor’s services when requested and will provide any
subsequent licenses during the life of the contract, when requested.
B.2. MANAGEMENT’S ASSERTIONS AND REPRESENTATIONS
Management's written assertions are the basis for the auditor’s testing and therefore are an
integral part of the engagement. The school should provide its management’s assertions in a
letter to you. In their letter, the school’s management should assert that it complied with each of
Page 18HEERF Audit Guide March 31, 2021
CHAPTER 2 – HEERF COMPLIANCE ATTESTATION ENGAGEMENTS
the following compliance requirements described in Chapter 2, Section C of this Guide, as
applicable:
• Activities Allowed or Unallowed
• Allowable Costs and Cost Principles
• Earmarking
• Period of Performance
• Procurement Suspension and Debarment
• Reporting
The specific required assertions are found at the beginning of each compliance requirement in
Chapter 2, Section C. If the school did not comply with one or more of the compliance
requirements, school management must modify its assertions to disclose the noncompliance.
You should also obtain required written representations from the school’s management as part of
the compliance attestation engagement. You may choose to obtain the assertions along with
management’s written representations in one letter. The written representations that are required
as part of the compliance attestation engagement can be found at AT-C § 205A Examination
Engagements, paragraph 50 and AT-C §315 Compliance Attestation, paragraph 17. If the scope
of a compliance attestation engagement is restricted because the school refused to furnish the
appropriate written assertions and/or representations, ED may initiate administrative proceedings
leading to sanctions against the school.
B.3. ATTESTATION RISK
The attestation documentation should evidence your assessed level of risk. Attestation risk is the
risk that you express an inappropriate opinion or conclusion, as applicable, when the subject
matter or assertion is materially misstated. You should design and implement overall responses
to address the assessed risks and should obtain sufficient appropriate evidence to reduce
attestation risk to an acceptably low level (AT-C § 105A.10 [Attestation Risk] and AT-C
§ 205A.19-.20).
B.4. CONSIDERING INTERNAL CONTROL IN THE COMPLIANCE
ATTESTATION ENGAGEMENT
Since grant funds awarded under the HEERF are subject to the requirements of the Uniform
Guidance, schools are required by 2 C.F.R. § 200.303(a) to establish and maintain effective
internal control over the HEERF awards that provides reasonable assurance that the school is
managing the HEERF awards in compliance with Federal statues, regulations, and the terms and
conditions of the HEERF awards. These internal controls should be in compliance with guidance
in “Standards for Internal Control in the Federal Government” issued by the Comptroller General
of the United States or the “Internal Control Integrated Framework”, issued by the Committee of
Sponsoring Organizations of the Treadway Commission.
Relevant guidance for your consideration of the school’s internal control in the compliance
attestation engagement is provided in AT-C § 205A and AT-C § 315.
Page 19HEERF Audit Guide March 31, 2021
CHAPTER 2 – HEERF COMPLIANCE ATTESTATION ENGAGEMENTS
To meet the objectives of this Guide, you should document your understanding of internal
control over compliance for each compliance assertion sufficient to plan the engagement and to
assess control risk. In order to obtain this understanding, you should inquire of management,
supervisors, and staff personnel; inspect the school documents; and observe the school’s
activities and operations. Due to the coronavirus pandemic, these procedures may need to be
performed remotely.
The HEERF programs may be administered by more than one organizational component within a
school and each component may maintain separate or different internal control, policies, and/or
procedures for ensuring compliance. In such cases, you should assess the controls in place at
each component that administers a material portion of the program activity.
A deficiency in internal control over compliance exists when the design or operation of a control
does not allow management or employees, in the normal course of performing their assigned
functions, to prevent or detect and correct noncompliance with a compliance requirement of the
HEERF programs on a timely basis. Consistent with GAGAS 7.42, for compliance attestation
engagements conducted in accordance with this Guide, you should report identified deficiencies
in internal control over compliance that are material weaknesses and significant deficiencies in
internal control over compliance, as defined below:
Material Weakness: A deficiency or combination of deficiencies in internal control over
compliance that results in a reasonable possibility that a material noncompliance with a type of
compliance requirement will occur that will not be prevented, or detected and corrected, on a
timely basis.
Significant Deficiency: A deficiency, or combination of deficiencies, in internal control over
compliance that is less severe than a material weakness in internal control over compliance yet is
important enough to merit attention by those charged with governance.
B.5. CONSIDERING AND REPORTING FRAUD IN THE COMPLIANCE
ATTESTATION ENGAGEMENT
Relevant guidance for the consideration of fraud in the compliance attestation engagement is
provided in AT-C § 205A. During the engagement, you should consider whether your risk
assessment procedures and other procedures related to your understanding of the school’s
compliance indicate risk of material noncompliance due to fraud. You should also make
inquiries of appropriate parties to determine whether they have knowledge of any actual,
suspected, or alleged fraud, evaluate whether there are unusual or unexpected relationships that
indicate risks of material noncompliance due to fraud, and respond appropriately to fraud or
suspected fraud (AT-C § 205A.32-.33).
In conducting the attestation engagement, you should exercise due professional care when
pursuing any indication of fraud, so that potential future investigations or legal proceedings are
not compromised. If you detect indications of fraud related to HEERF program funds, or if you
learn that management identified possible fraud related to HEERF program funds and failed to
report the possible fraud, you must report this immediately to the appropriate regional office of
Page 20HEERF Audit Guide March 31, 2021
CHAPTER 2 – HEERF COMPLIANCE ATTESTATION ENGAGEMENTS
ED’s OIG, Investigation Services (OIG/IS) in accordance with this Guide. A listing of these
offices and contact information can be found on OIG/IS website.
After reporting the matter immediately, promptly prepare a separate written report concerning
fraud or indications of such activities. The report must include all information required for
reporting a finding as outlined in GAGAS 7.48-.50. This report must be submitted to the
appropriate ED OIG/IS regional office either within 30 days after the date of discovery of the
act, or within the time frame agreed to by you and the ED OIG/IS. The transmittal should
request ED OIG/IS to reply by letter or email to you to acknowledge receipt of the report. It
should also request that ED OIG/IS (1) advise you if you can also submit the separate written
report with your compliance attestation engagement report to ED, and (2) whether you can
reflect the contents of the separate report in your compliance attestation engagement report. You
should retain the ED OIG/IS acknowledgement in your attestation documentation.
You should not submit the separate written report with your compliance attestation engagement
report to ED, unless the ED OIG/IS has advised you in writing that you may do so. Also, you
should not reflect the contents of the separate report in your compliance attestation engagement
reports, unless the ED OIG/IS has advised you in writing that you may do so. If excluding this
information from your compliance attestation engagement reports would cause a departure from
attestation standards, contact the Non-Federal Audit team at oignon-federalaudit@ed.gov to
discuss how the matter should be handled.
B.6. MATERIALITY FOR PURPOSES OF PROVIDING OPINION
Materiality for purposes of compliance differs from materiality for financial reporting purposes.
In accordance with AT-C § 205A.16, § 315.12, and this Guide, for the compliance attestation
engagements, you should consider materiality for each type of compliance requirement.
Materiality should be considered in the context of qualitative factors and, when applicable,
quantitative factors. Keep in mind that consideration of materiality is affected by the nature of
the compliance requirements, which may or may not be quantifiable in monetary terms. You
should issue a qualified or adverse opinion when reporting instances of noncompliance that
individually or collectively are material in relation to each type of compliance requirement.
B.7. FOLLOW-UP ON RESOLUTION OF PRIOR FINDINGS
In accordance with GAGAS 7.13, you should evaluate whether the school has taken appropriate
corrective action to address findings and recommendations from previous engagements that
could have a significant effect on the subject matter. When planning the engagement, you
should ask management to identify previous audits, attestation engagements, program reviews,
and other studies that directly relate to the school’s compliance with the HEERF program
requirements in this Guide, including whether related recommendations have been implemented.
From the records of the school, you should review each finding contained in each report and all
correspondence between the school and the report issuer, including any final determinations, that
relates to the resolution of the finding(s). You should determine whether each prior finding has
been resolved. You should use this information in assessing risk and determining the nature,
Page 21You can also read
